Binance began restoring withdrawals in phases on Sunday, days after hackers stole $6.3 billion from the exchange in a matter of minutes. The first batch of major crypto asset withdrawals was back online by morning, covering bitcoin, ether, USDT, USDC, BNB, SOL, XRP, and several others. The company has said it is covering the losses with its own funds and the Secure Asset Fund for Users (SAFU).
According to CoinDesk, more than $6 billion worth of tokens flowed out of wallets associated with Binance once withdrawals were turned back on, based on DefiLlama wallet-flow data. That figure equals roughly 3.6% of the $171 billion in assets Binance reported holding before the attack. Even after all of these outflows, the DefiLlama tracker still showed about $129 billion remaining in Binance-linked wallets.
Binance’s own accounting claimed the exchange processed $4.649 billion in withdrawals against $1.01 billion in deposits during the first nine-and-a-half hours after withdrawals were turned back on, for a net outflow of about $3.64 billion, or 2.1% of assets under management. Binance co-founder and former CEO Changpeng “CZ” Zhao posted on X that most of the net outflow occurred in the first couple of hours and that “98% choose to stay.”
Binance also said it had covered approximately 95% of the $6.3 billion in stolen assets as of Sunday, up from about 90% the day before, with major holdings including bitcoin, ether, USDT, BNB, SOL, USDC, and XRP fully backed at 100%. The remaining uncovered balance consists of less liquid tokens that the company is still buying through open-market and over-the-counter channels. The company has also committed to replenishing SAFU back to roughly $1 billion.
Following the Money
Blockchain analytics firms have tracked large portions of the stolen funds associated with the Binance hack, which the FBI and many others have attributed to North Korea’s TraderTraitor group. Elliptic described the activity as laundering on autopilot, as one Tron distribution wallet released funds on a strict hourly schedule for 31 straight hours with no overnight pause. Inside each of those hourly batches, individual transfers were rarely more than 30 seconds apart, and the receiving wallets typically forwarded the money onward within about two minutes.
Elliptic also noted repeated swap amounts into THORChain (one value appeared 19 times) and automatic re-sends when a bridge rejected deposits. The firm wrote that “the Binance funds are being moved by something that does not sleep.”
Chainalysis similarly flagged automated movements of the funds associated with the Binance hack. In a statement shared with Gizmodo, Chainalysis CEO Jonathan Levin said of the hacker’s laundering efforts:
“They have too much money for their trusted laundering venues to handle. So the money will flow to a wider network of services, like bridges, instant exchanges, and swappers due to a wider set of money launderers. Our investigators are tracking novel automated laundering mechanisms using our new AI capabilities that match the attempted speed and sophistication of the launderers.”
On Tron alone, blockchain observer SomaXBT tracked approximately $242 million in funds associated with the theft moving through the network during the first two days. Of that amount, approximately $194 million left Tron through bridges and swap services, including Relay, THORChain, Chainflip, and Symbiosis. Another $41.7 million passed through Bitget Wallet, although its ultimate destination remained unresolved.
Interestingly, Monero and Zcash, which are often pointed to as crypto assets with enhanced privacy that would complicate tracing, do not appear to have been used at meaningful scale for these proceeds, likely due to limited liquidity. Cross-chain crypto exchanges like THORChain are often used by criminals to swap stablecoins and other crypto assets into bitcoin, as it is the most reliable and stable of all the crypto-native assets that cannot be frozen by third parties. “Based on the Bybit case, we expect the attacker to swap the ETH for bitcoin and then try to cash it out through OTC brokers and exchanges,” Elliptic wrote in a Monday update on the Binance hacker’s laundering efforts.
Increased Scrutiny of THORChain
THORChain has drawn particular attention because it has repeatedly been used by North Korea-connected groups after large hacks. After the February 2025 Bybit theft of roughly $1.4 billion worth of crypto, researchers tracked roughly 85%, or about $1.2 billion, of the proceeds through the protocol into bitcoin. CoinDesk previously referred to it as “North Korea’s Favorite Crypto Laundering Tool” in that context. A similar pattern has appeared with the $388 million Bitget hack in September and now with the funds from last week’s Binance hack.
Critics have accused the protocol of using decentralization theater to absolve itself of any responsibility for funds connected to North Korean actors that move through the exchange, despite previously halting the “unstoppable” protocol during an instance where THORChain itself dealt with its own security incident. On X, Chainalysis noted that THORChain “just inadvertently delayed the laundering of a significant amount of funds stolen from Binance” after the protocol paused swaps in response to an Ethereum block reorganization that led to technical issues.
In response to an argument from THORChain co-founder John-Paul Thorbjornsen that THORNodes should not be expected to pause or censor transactions, much like Bitcoin or Ethereum nodes, pseudonymous blockchain security researcher Tanuki42 responded:
“This is a false equivalence and you know it. Is this the hill you really want to die on? If all ‘your principles’ have brought to the world is enabling dictatorial regimes to steal money and build nuclear weapons, all whilst building extraordinary personal wealth: you are not a martyr you are fucking fool.”
Tanuki42 also pointed to a 7 News Spotlight documentary on the Bybit hack that included Thorbjornsen saying, “[North Korea] might actually need that $1.5 billion in order to feed their population.”
THORChain co-founder Chad Barraford has said the protocol has no selective blacklist by design and that existing halts are circuit breakers that stop everyone at once. In a previous debate with blockchain security researcher Taylor Monahan, however, he acknowledged that if two-thirds of node operators agreed, then laundering could be blocked.
Notably, the crypto industry more broadly responded to the Binance hack by freezing large amounts of stablecoins and generally acting like the banks this technology was originally intended to disintermediate.
The FBI, along with the U.S. Secret Service and IRS Criminal Investigation, has urged THORNode operators, RPC node operators, instant exchanges, DeFi services, and other virtual asset service providers to block transactions tied to addresses TraderTraitor is using. The agency also listed hundreds of blockchain addresses allegedly connected to the hack.
On X, The Rage’s L0la L33tz argued that the request is directed at non-custodial service operators and that claiming technical inability may not shield operators from legal risk, as previously seen in the Tornado Cash case.
They’re not asking for information you fucking moron.
They’re telling you explicitly to block the DPRK transactions.
It’s a warning shot bro. TAKE THE FUCKING WARNING AND STOP FUCKING AROUND.
Please. For fucks sake. 😭😭😭😭😭😭
— Tay 💖 (@tayvano_) November 1, 2026
Monahan replied to a post from Barraford regarding THORChain node operators’ lack of information on the Binance hack, stating, “They’re not asking for information you fucking moron. They’re telling you explicitly to block the DPRK transactions. It’s a warning shot bro. TAKE THE FUCKING WARNING AND STOP FUCKING AROUND. Please. For fucks sake.”
